fix: validate ADDON Jira ticket in PR title#511
Merged
mkolasinski-splunk merged 7 commits intoJul 15, 2026
Conversation
Add a step to the validate-pr-title job that checks for ADDON-XXXXX (5-6 digit number) in the PR title, failing with a clear error message if missing. Co-Authored-By: Claude <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d982f008d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
mkolasinski-splunk
changed the title
- Pass the PR title through env: instead of interpolating it into the run: script text, so a crafted title can't trigger command substitution on the runner. - Anchor the ticket regex so a longer digit run (e.g. ADDON-1234567) no longer satisfies the check via its 5-6 digit prefix.
Adds a comment-on-jira job that posts a link back to the commit (and originating PR, if found) on any ADDON-XXXXX ticket referenced in a commit pushed to main/develop, giving reporters visibility into when their fix landed. Uses the Jira REST API directly via curl rather than a third-party comment action (atlassian/gajira-comment has a known RCE, CVE-2020-14189). Requires new JIRA_BASE_URL/JIRA_USER_EMAIL/JIRA_API_TOKEN secrets; consuming repos need these added before bumping to the next tag.
addonfactory-docs-on-github-integration and issue-exploder already use ATLASSIAN_EMAIL/ATLASSIAN_TOKEN (or JIRA_LOGIN/JIRA_API_TOKEN) against a hardcoded splunk.atlassian.net rather than a configurable base URL. Match that instead of introducing new JIRA_* secret names.
…a comments Live test against test-addonfactory-repo (push to main, ADDON-88759) showed the PR lookup 403ing (job only had contents:read) and, because gh api's stderr/stdout still populated PR_URL before the `|| true` swallowed the exit code, the raw JSON error body got embedded as the "PR" link href in the posted Jira comment.
Reword the posted comment to "{author} mentioned this issue in a commit
of {repo} on branch {branch}:" followed by the commit/PR links, matching
the phrasing already used by the existing GitLab->Jira integration
(srv-ssc-gitlab) so both integrations read consistently on a ticket.
rasteja
reviewed
Jul 9, 2026
rasteja
requested changes
Jul 15, 2026
The Jira comment job only matched the first line of the commit message and the first regex match, so pushes referencing multiple tickets (or a ticket outside the first line) only got a comment on one.
rasteja
reviewed
Jul 15, 2026
rasteja
left a comment
rasteja
left a comment
Contributor
There was a problem hiding this comment.
One required caller-contract issue needs resolution before rollout.
rasteja
approved these changes
Jul 15, 2026
rasteja
left a comment
rasteja
left a comment
Contributor
There was a problem hiding this comment.
Approved. The Jira ticket-reference handling is fixed, and the required-secret rollout is tracked in ADDON-89095.
mkolasinski-splunk
deleted the
feat/validate-addon-jira-ticket-in-pr-title
branch
July 15, 2026 13:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
validate-pr-titlejob that enforcesADDON-XXXXX(5–6 digit Jira ticket number) in the PR title, failing with a clear::error::annotation if missing (runs after the existing semantic PR title check).comment-on-jirajob: on push tomain/develop, scans commit messages forADDON-XXXXXreferences and posts a comment on each referenced ticket linking back to the commit (and originating PR, if found), worded to match the existing GitLab→Jira integration convention ({author} mentioned this issue in a commit of {repo} on branch {branch}:).ATLASSIAN_EMAIL/ATLASSIAN_TOKENsecrets (hardcodedhttps://splunk.atlassian.netbase URL), matching the naming convention already used byaddonfactory-docs-on-github-integration; posts via raw Jira REST API v3 + ADF body rather thanatlassian/gajira-comment(which has a known RCE, CVE-2020-14189).::warning::.Test plan
ADDON-XXXXXin the title → job fails with the error messageADDON-12345orADDON-123456in the title → job passessplunk/test-addonfactory-repo(sandbox repo, temporarily pointed at this branch, reverted tov5.4after each round), commenting on real ticket ADDON-88759:pull_requestevent →comment-on-jiracorrectlyskipped(job only fires onpush)main, no originating PR → comment posted with commit link only, no "via PR" clause (run)mainvia squash-merged PR → comment posted with commit link and correct PR link (run, PR #374)contents: read) and leaked the raw error JSON into the comment's linkhref(run, see resulting malformed comment) — fixed by addingpull-requests: readand guarding thegh apifailure path (1c8ba82)🤖 Generated with Claude Code